This vulnerability affects the Totolink CA750-PoE device running firmware version 6.2c.510. The flaw exists in the setWiFiWpsConfig function of the Setting Handler component, specifically in the /cgi-bin/cstecgi.cgi file. By manipulating the PIN argument, an attacker can perform OS command injection remotely, potentially executing arbitrary commands on the device. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation could allow a remote attacker to execute arbitrary OS commands on the affected device, potentially compromising device integrity and confidentiality. The medium CVSS score reflects the moderate risk due to ease of attack and potential impact. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only. Monitor for updates from Totolink regarding patches or mitigations. Avoid exposing the device management interface directly to untrusted networks.